Review an agent feature before cloud release

Draw the trust boundaries

List the user, browser, API server, database, job worker and provider. For every action, identify the account whose authority it uses. A user request can authorize a product operation without granting the agent arbitrary shell, network or database access. Treat retrieved pages, uploaded documents and tool output as data, not instructions that can broaden authority.

Review the actual implementation

Trace one allowed request and one denied request from entry point to storage. Verify that role checks use current account state, enrolled MFA assurance is enforced and service keys never reach the browser. Test cross-user identifiers and direct database access as well as the page’s controls. If a migration owns revision and audit invariants, test its transaction directly. Source review and an observed rejection are complementary evidence.

Constrain tools and providers

Allow only the necessary endpoints and operations. Validate arguments with strict schemas; use bounded file paths, request sizes and timeouts. Keep credentials in approved secret storage and redact diagnostics. A source link or skill installation does not connect a provider or establish a paid entitlement. Disable external calls until the owner’s setup and outbound authority are confirmed.

Prepare deployment and rollback

Use project-specific resources, ports and environment names. Separate readiness checks from actions that publish, bill or change production data. Record migrations, build revision and a rollback procedure before release. Backup verification should include restoration evidence where the change warrants it. For cloud platforms, follow their current deployment and access documentation instead of reusing another project’s credentials or reset commands.

Test human recovery

Exercise a network interruption, expired session, permission change, conflicting save and provider failure. Tell users what happened and what they can do next without exposing stack traces or SQL. Preserve safe drafts, and never retry an uncertain consequential action without idempotency or reconciliation. Security review should return specific findings, evidence boundaries and unresolved gates. A green local test suite is not production acceptance; require the agreed owner and live-service checks before claiming release.